INFORMATION ON THE PROCESSING OF PERSONAL DATA – Website “BE SUSTAINABLE”
This privacy notice is provided pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR) and Italian Legislative Decree no. 196 of 30 June 2003, as amended by Legislative Decree no. 101 of 10 August 2018 (“Personal Data Protection Code”) by:
► Legacoop Emilia-Romagna, registered office at Viale Aldo Moro, 16 – 40127 Bologna, Italy, Tax Code 80040130371, in the person of its legal representative pro tempore, as the Data Controller (“Controller”).
The Controller, aware of the importance of ensuring the security of private information, and in compliance with European and Italian data protection legislation and the transparency principle under Article 12 of the GDPR, provides the following information to inform users about the nature and methods of personal data processing.
1. Data Processed
The Controller processes navigation data not directly provided by the user—collected within the limits of Article 14(5) of the GDPR—such as access logs, data volume transferred, session IDs, IP addresses, URLs, and other metadata related to Internet communication protocols. The Controller also processes personal identification and contact data necessary for the website’s use and related services.
2. Legal Basis and Purposes of the Processing
Your personal data are processed without your explicit consent (pursuant to Article 6(f) GDPR) for the following purposes:
i. Technical operation of the website (legitimate interest of the Controller).
In addition, your data may be processed without consent to:
i. Fulfil legal obligations or comply with EU regulations or authorities;
ii. Perform tasks in the public interest or exercise public powers vested in the Controller;
iii. Exercise the Controller’s rights (e.g., legal defense).
3. Nature of Data Provision
Providing navigation data is mandatory, as it is technically necessary to enable website access.
4. Methods of Processing
The processing of your personal data is carried out by means of the operations indicated in Article 4, paragraph 1, no. 2) of the GDPR, i.e. any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adapting or altering, extracting, consulting, using, communicating by transmission, dissemination or any other form of making available, comparing or interconnecting, restricting, erasing or destroying. The processing of your data will be based on principles of correctness, lawfulness and transparency and may also be carried out using automated methods designed to store, manage and transmit them. It will be carried out using appropriate tools, as far as reasonable and state of the art, to ensure security and confidentiality through the use of appropriate procedures that avoid the risk of loss, unauthorised access, unlawful use and dissemination. Personal data may be stored on both computer and paper media, as well as on any other type of media deemed most suitable for processing.
5. Data Retention Period
Data will be retained only for the time strictly necessary to fulfil the above-mentioned purposes, in compliance with the minimization and storage limitation principles under Article 5(1)(c)(e) GDPR.
6. Data Access
The personal data processed by the Data Controller will not be disclosed, i.e. it will not be made known to unspecified parties, in any form whatsoever, including by making it available for consultation. However, it may be made accessible to volunteers and/or collaborators who work for and on behalf of the Data Controller and/or to certain external parties who provide sufficient guarantees that they have taken appropriate legal, organisational and technical measures to ensure that the processing meets the requirements of the GDPR and guarantees the protection of the rights of the data subject.
7. Data Disclosure
Data may be disclosed to entities legally entitled to access it under national or EU law, judicial authorities, or other bodies when required by law.
8. Data Transfers
Personal data will be managed and stored on servers belonging to the Data Controller and/or third-party companies appointed and duly designated as data processors, located within the European Union, in accordance with the provisions of Articles 45 et seq. of the GDPR. The servers are currently located in Italy. The data will not be transferred outside the European Union. In any case, it is understood that, should it become necessary to transfer the location of the servers, in Italy and/or the European Union and/or non-EU countries, such transfer will always be carried out in accordance with Articles 45 et seq. of the GDPR. In this case, however, the Data Controller hereby guarantees that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, stipulating, if necessary, agreements that guarantee an adequate level of protection and/or adopting the standard contractual clauses provided for by the European Commission.
9. Navigation Data
The computer systems and software procedures used to operate the website may acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes IP addresses or domain names of computers and terminals used by users, URI/URL (Uniform Resource Identifier and Uniform Resource Locator) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (e.g. successful, error, etc.) and other parameters relating to the user’s operating system and IT environment. These data, which are necessary for the use of web services, are also processed for the purpose of: i. obtaining statistical information on the use of the services (e.g. most visited pages, number of visitors per time slot or per day, geographical areas of origin, etc.); ii. checking the correct functioning of the services offered. This data is deleted immediately after processing (except where necessary for the investigation of crimes by the judicial authorities).
10. Data Subject Rights
Pursuant to Articles 15 to 21 of the GDPR, you have the right to: i. obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet recorded, and its communication in intelligible form; ii. obtain information on: a) the origin of the personal data; b) the purposes and methods of processing; c) the logic applied in the case of processing carried out with the aid of electronic instruments; d) the identification details of the Data Controller and Data Processors; e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it in their capacity as designated representative in the territory of the State, delegates, designated or authorised to process the data; iii. obtain: a) the updating, rectification or, where interested therein, integration of the data; b) the erasure, anonymisation or blocking of data that has been processed unlawfully, including data whose retention is unnecessary for the purposes for which it has been collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been brought to the attention, also with regard to their content, of those to whom the data have been communicated or disseminated, except in the case where this proves impossible or involves a manifestly disproportionate effort compared to the right being protected. Pursuant to Articles 15 to 21 of the GDPR, you may exercise the following specific rights: i. right of access; ii. right to rectification; iii. right to erasure (right to be forgotten), except where processing is necessary for the Controller to exercise its rights to freedom of expression and information, to comply with a legal obligation or to perform a task carried out in the public interest, for archiving purposes in the public interest, for scientific or historical research or for statistical purposes, for the establishment, exercise or defence of legal claims; iv. right to restriction of processing; v. right to object; vi. right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal; vii. right to lodge a complaint with the Data Protection Authority.
11. Exercising Your Rights
You have the right to request from the Data Controller: i. access to data concerning you, its correction or deletion; ii. the integration of incomplete data; iii. restriction of processing; iv. to receive the data in a structured, commonly used and machine-readable format; v. to withdraw any consent given for the processing of your personal data at any time and to object, in whole or in part, to the use of the data; vi. to lodge a complaint with the Authority, as well as to exercise the other rights granted to you by applicable European and Italian legislation. You may exercise your rights at any time by contacting the Data Controller:
► By registered mail: Legacoop Emilia-Romagna, Viale Aldo Moro, 16 – 40127 Bologna, Italy
► By email: segreteria@emilia-romagna.legacoop.it
12. Data Protection Officer (DPO)
Due to the processing activities carried out, the Data Controller has deemed it necessary to appoint Dr Ferdinando Mainardi as Data Protection Officer (DPO) pursuant to Article 37 of the GDPR. He can be contacted by email at: ferdinando.mainardi@mywaysec.com
The Data Controller
Legacoop Emilia-Romagna
